Consent is a button, not a sentence

Section 6 of the DPDP Act sets the bar: consent must be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action, and limited to the data needed for the purpose.

What fails

• Pre-ticked boxes, and banners that only offer “OK”.
• “By continuing to browse, you agree.” Scrolling is not an affirmative action.
• One consent for many unrelated purposes.
• An “Accept” button that stands out while “Reject” hides in grey.

What works

• A notice first, in plain words, itemising the data and why you want it (section 5). People can ask for it in English or any language in the Eighth Schedule.
• A separate choice for each purpose, off until someone switches it on.
• Withdrawal as easy as giving it: the same two clicks, any time (section 6(4)).
• A record of what each person agreed to, and when. If it is ever disputed, the burden of proof is on you (section 6(10)).

This website asks the same way. Its one optional purpose stays off until you choose, and Privacy settings, at the foot of the page, undoes it in a click.